> For the complete documentation index, see [llms.txt](https://argos-ci.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://argos-ci.com/docs/learn/account-and-access/saml-single-sign-on.md).

# SAML single sign-on

Configure SAML single sign-on with providers like Okta or Auth0 to authenticate your Argos team members.

{% hint style="info" %}
SAML SSO is a paid add-on ($200 / month) available to teams on a Stripe-based subscription. It is included in the [Enterprise](/docs/learn/billing-and-subscription/pricing-plans.md#enterprise-plan) plan, and comes with [SCIM provisioning](/docs/learn/account-and-access/scim-provisioning.md).

Only team members with the [owner role](/docs/learn/account-and-access/team-members-and-roles.md#owner-role) can configure SAML SSO.
{% endhint %}

To manage your [team members](/docs/learn/account-and-access/team-members-and-roles.md) through a third-party identity provider like [Okta](https://www.okta.com/) or [Auth0](https://auth0.com/), configure Security Assertion Markup Language (SAML) from **Team Settings -> Authentication**.

Once enabled, team members can authenticate with your configured identity provider, and new users signing in with SAML will be added to your team.

![The SAML SSO settings for a Team.](https://content.gitbook.com/content/0slCNmeVzY3qdh0I85HX/blobs/qhufiLVkPuv86miOxCcb/saml%20settings%204a875c027de3b7cc49da61c3b7cbfcbd.png)

### Enabling the add-on

Unless your plan includes SAML SSO, enable it as an add-on first:

{% stepper %}
{% step %}
Go to your team settings and open the **Billing** tab.
{% endstep %}

{% step %}
In the **Add-ons** section, select **Enable** next to **SAML Single Sign-On**.
{% endstep %}

{% step %}
Select **Confirm and Pay**. The feature is activated immediately.
{% endstep %}
{% endstepper %}

The add-on appears as a "SAML SSO" line on your monthly invoice. You can disable it at any time from the **Add-ons** section; team members will then no longer be able to sign in with SAML.

### Configuring SAML SSO

1. Ensure you are an [owner](/docs/learn/account-and-access/team-members-and-roles.md#owner-role) of the team.
2. From the dashboard, select the team in the scope selector.
3. Open the **Settings** tab, then go to **Authentication**.
4. In **SAML Single Sign-On**, click **Configure** and follow the setup flow for your identity provider.
5. Optionally enforce SAML SSO for all team members after confirming authentication works.

### Enforcing SAML

For additional security, you can enforce SAML so team members can only access team resources when their current session is authenticated with SAML.

1. Ensure you are an [owner](/docs/learn/account-and-access/team-members-and-roles.md#owner-role) and currently authenticated with SAML.
2. Go to **Team Settings -> Authentication -> SAML Single Sign-On**.
3. Turn on **Require Team Members to login with SAML to access this Team**.

![SAML SSO configured and enforced.](https://content.gitbook.com/content/0slCNmeVzY3qdh0I85HX/blobs/SsSDoqqpifDZBDCgDWMs/saml%20enforced%200b9acb80b05d917ee70c452b00b6a254.png)

When you modify your SAML configuration, enforcement is automatically disabled. Re-authenticate with SAML and verify the new configuration before re-enabling enforcement.

### Authenticating with SAML SSO

After SAML is configured, team members can sign in using SAML SSO:

1. On the login page, click **Continue with SAML SSO** and enter your team slug.
2. Click **Continue with SAML SSO** again to be redirected to your identity provider.
3. Complete authentication to access Argos.

#### Customizing the login page

You can share an Argos login URL that only displays the SAML SSO option for a specific team.

```
https://app.argos-ci.com/login?saml=team_slug
```

Replace `team_slug` with your team identifier in Argos URLs.

![Argos's login page showing only the SAML SSO login button.](https://content.gitbook.com/content/0slCNmeVzY3qdh0I85HX/blobs/Wow3ioE4YdShlZtc8bEt/saml%20login%209c431d652c0bef06bc59ca1366e15142.png)

### Managing team members

With SAML SSO, users authenticate through your identity provider, but team membership can still be managed from Argos team settings.

Members are added to your team when they first sign in with SAML, but you can also pre-provision members from the **Team Settings -> Members** page.

{% hint style="success" %}
**Let your identity provider manage the team.** With [SCIM provisioning](/docs/learn/account-and-access/scim-provisioning.md), included with SAML SSO, your identity provider adds people to the team when they are assigned to Argos, removes them as soon as they are unassigned or deactivated, and can set their roles.
{% endhint %}

Without SCIM, a user is provisioned on their first SAML sign-in. Argos creates their account if they don't have one and adds them to the team with the team's default access role.

To offboard someone without SCIM, remove them from the team: in **Team Settings -> Members**, open the member's actions menu and select **Remove from Team**. Also remove them from the Argos app in your identity provider. Otherwise, signing in with SAML again adds them back to the team.

When SAML SSO is enforced, team members must have an active SAML session to access team resources. If a member's SAML session expires, they will be prompted to re-authenticate with SAML to regain access.

### SAML providers

Argos supports the following SAML providers:

* [Okta](https://www.okta.com/)
* [Auth0](https://auth0.com/)
* [Google](https://accounts.google.com/)
* [Microsoft Entra (formerly Azure Active Directory)](https://www.microsoft.com/en-in/security/business/identity-access/microsoft-entra-single-sign-on)
* [Microsoft ADFS](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services)
* [OneLogin](https://onelogin.com/)
* [Duo](https://duo.com/product/single-sign-on-sso/)
* [JumpCloud](https://jumpcloud.com/)
* [PingFederate](https://www.pingidentity.com/en/platform/capabilities/single-sign-on.html)
* [ADP](https://apps.adp.com/en-US/home)
* [Keycloak](https://www.keycloak.org/)
* [Cyberark](https://www.cyberark.com/products/single-sign-on/)
* [OpenID](https://openid.net/)
* [VMware](https://kb.vmware.com/s/article/2034918)
* [LastPass](https://www.lastpass.com/)
* [miniOrange](https://www.miniorange.com/products/single-sign-on-sso)
* [NetIQ](https://www.microfocus.com/en-us/cyberres/identity-access-management/secure-login)
* [Oracle Cloud](https://docs.oracle.com/en/cloud/paas/content-cloud/administer/enable-single-sign-sso.html)
* [Salesforce](https://help.salesforce.com/s/articleView?id=sf.sso_about.htm\&type=5)
* [CAS](https://www.apereo.org/projects/cas)
* [ClassLink](https://www.classlink.com/)
* [Cloudflare](https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/dash-sso-apps/)
* [SimpleSAMLphp](https://simplesamlphp.org/)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://argos-ci.com/docs/learn/account-and-access/saml-single-sign-on.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.